Industry
SaaS
Legal work for subscription software businesses selling from Pakistan to the world — contracts that hold, dollars that arrive through the right channel, and code the company actually owns.
A SaaS business run from Pakistan is an export business that never ships anything, and Pakistani law meets it in three places: the contract layer, the money layer, and the ownership layer. Most founders get the product right and improvise the other three. The improvisation works until the first enterprise customer, the first tax assessment, or the first financing — the three events that read the paper.
The contract layer
The subscription agreement is the entire commercial relationship, and it deserves better than a template written for Delaware. Pakistani law supports electronic contracting — the Electronic Transactions Ordinance 2002 gives electronic records and signatures legal effect — but the questions that decide disputes are practical ones. Was acceptance captured in a way you can prove two years later? Do the auto-renewal and price-change mechanics actually bind the customer, or merely surprise them? Does the limitation of liability hold together under the Contract Act 1872, with carve-outs that match what your insurer covers? For companies selling upmarket, the service level agreement and the data-processing addendum stop being formalities: enterprise and foreign customers arrive with their own paper, and the negotiation is won by the side that understands both legal systems in the room. We draft and negotiate that stack — terms of service, MSA, SLA, DPA, reseller and referral agreements — for enforcement, not decoration. Two clauses deserve particular attention in the Pakistani context. Suspension and termination mechanics need to work against a customer who stops paying but keeps using the product, because collection litigation here is slow and the practical remedy is the off switch, exercised in a contractually defensible way. And the governing-law and dispute clause should be chosen deliberately: arbitration with a workable seat often serves a cross-border SaaS relationship better than a foreign court judgment that then needs enforcement in Pakistan.
The money layer
Cross-border billing is where Pakistani SaaS companies carry the most silent risk. Export proceeds are regulated: the State Bank's Foreign Exchange Manual requires services-export receipts to be realized through authorized dealers within prescribed timelines, and as of mid-2026 exporters may retain a portion of proceeds in a special foreign-currency account to pay foreign vendors [RETENTION PERCENTAGE — TO BE VERIFIED BY REVIEWING LAWYER]. Routing revenue through a founder's personal account abroad, or leaving it parked in a payment processor indefinitely, breaks that framework — and simultaneously undermines the tax position, because the reduced final tax on IT and IT-enabled service exports under section 154A of the Income Tax Ordinance 2001 is tied to proceeds arriving through proper channels and to Pakistan Software Export Board registration [CONDITIONS — TO BE VERIFIED BY REVIEWING LAWYER]. Domestic revenue adds a provincial dimension: a Lahore-based provider answers to the Punjab Revenue Authority under the Punjab Sales Tax on Services Act 2012, and the classification of software services under the current schedule determines whether invoices should have carried tax the company never charged. The outbound direction matters too: paying for foreign infrastructure, tools, and advertising from Pakistan runs through the banks under State Bank instructions that have loosened for technology companies but still carry documentation requirements and limits [CURRENT LIMITS — TO BE VERIFIED BY REVIEWING LAWYER]. We set up the channel architecture — banking, PSEB, FBR, provincial registration — as one design, because each piece is a condition of the others.
The ownership layer
Investors in SaaS buy two assets: the revenue and the repository. The second is the one Pakistani founders most often fail to own. Copyright in code vests under the Copyright Ordinance 1962, and the default rules do not transfer a contractor's work to the client who paid for it — assignment must be in writing. A codebase assembled from freelancers, a departed technical co-founder, and an agency engagement is, without assignment deeds, a title problem wearing a product's clothes. The same discipline extends to the brand (trademark registration under the Trade Marks Ordinance 2001 before a copycat registers first) and to what leaves with employees, which is a matter of confidentiality and IP-assignment clauses signed at hiring, not argued at departure. Pakistani courts enforce confidentiality far more readily than they enforce non-competes, so the protection strategy leans on assignment, confidentiality, and access controls rather than on restraining former employees from working.
How we serve SaaS companies
Our SaaS work is a standing arrangement more often than a one-off project: the contract stack maintained as the product moves upmarket, the export-channel compliance reviewed against the State Bank's current circulars, assignments collected as the team grows, and the company kept diligence-ready between rounds. The regulatory inputs here — SBP circulars, the tax treatment of IT exports, provincial schedules, and the pending data-protection legislation — change with unusual frequency, and everything on this page is stated as of mid-2026. Where the current instrument matters to a decision, we check it that week, not that quarter.
The Five Recurring Problems
The problems this sector keeps producing.
- 01
Subscription terms that were never really agreed
Many Pakistani SaaS companies launch on terms of service copied from a US template and never accepted in a way a court here would recognize. The Electronic Transactions Ordinance 2002 gives electronic contracting a statutory footing, but enforceability still turns on how consent was captured, how amendments are notified, and whether the limitation of liability survives the Contract Act 1872. The document is tested only when a customer refuses to pay or an outage causes loss.
- 02
Dollar revenue outside the banking channel
Subscription receipts routed through informal channels or left offshore sit on the wrong side of the State Bank's export-proceeds rules under the Foreign Exchange Manual, which require realization through authorized dealers within prescribed timelines. The same routing quietly disqualifies the company from the concessional tax treatment that depends on proceeds arriving through proper channels.
- 03
Losing the export tax concession
As of mid-2026, export proceeds of IT and IT-enabled services attract a reduced final tax under section 154A of the Income Tax Ordinance 2001, conditioned on registration with the Pakistan Software Export Board and compliance formalities [RATE AND CONDITIONS — TO BE VERIFIED BY REVIEWING LAWYER]. Companies that never registered, or that mixed export and domestic revenue without separation, discover at assessment that they have been taxed as if the concession never existed.
- 04
Data-location questions with no data statute to answer them
Pakistan has no general data-protection law in force as of mid-2026, so where customer data may sit is decided by contract and by the customer's own regulator — a bank customer brings the State Bank's outsourcing and cloud expectations with it, a foreign enterprise brings GDPR. SaaS companies keep failing enterprise security review not on their engineering but on their paper.
- 05
Code the company does not own
Under the Copyright Ordinance 1962, a freelancer or agency that wrote the early codebase keeps the copyright unless it was assigned in writing. Years later the company sells a product whose foundational code legally belongs to a contractor last seen on Upwork. Chain-of-title reconstruction at diligence is possible, but it is expensive and it depends on people who no longer answer email.
The Regulators That Matter
Who you answer to — and for what.
- State Bank of Pakistan
- Governs how foreign subscription revenue comes home — realization timelines, retention in exporters' foreign-currency accounts, and outward payments for foreign tools and infrastructure.
- Pakistan Software Export Board
- Registration body for IT and IT-enabled services exporters; registration underpins the concessional export tax regime and certain remittance facilitations [SCOPE — TO BE VERIFIED BY REVIEWING LAWYER].
- FBR
- Administers the export final-tax regime under the Income Tax Ordinance 2001 and the withholding obligations a growing SaaS payroll carries.
- Punjab Revenue Authority
- Levies sales tax on services on Punjab-based providers under the Punjab Sales Tax on Services Act 2012; the treatment of software and exported services has shifted over the years and needs checking against the current schedule.
Mapped Services
The practices this industry draws on.
- Technology Law The regulatory frame around the product — electronic contracting, platform exposure, and sector rules customers import.
- Commercial Contracts Subscription agreements, SLAs, DPAs, and reseller terms built for enforcement in Pakistan, not just for the website footer.
- Data Privacy Data-handling frameworks built on contract and sectoral rules while Pakistan's data statute remains pending.
- Copyright Ownership of the codebase secured in writing — assignments from every contractor who ever committed to the repository.
- Tax Advisory Keeping the export concession, separating domestic from export revenue, and handling provincial services tax.
- Fundraising & Investment SaaS metrics-driven rounds where revenue recognition, churn warranties, and IP title decide the negotiation.
Questions, Answered
What clients in this industry ask.
Broadly yes — the Electronic Transactions Ordinance 2002 recognizes electronic records and signatures — but enforceability turns on implementation. Consent should be captured affirmatively, amendments notified rather than silently posted, and the file of who accepted what and when preserved. We draft terms with the evidence trail in mind.
Yes, and you should — but the proceeds must come home through an authorized dealer within the State Bank's timelines, coded correctly as services exports. As of mid-2026 exporters may retain a portion in a special foreign-currency account for foreign expenses [PERCENTAGE — TO BE VERIFIED BY REVIEWING LAWYER]. Stripe-to-personal-account arrangements create exchange-control and tax problems simultaneously.
If you export software or IT-enabled services, registration with the Pakistan Software Export Board is in practice the gateway to the reduced final tax on export proceeds and certain remittance facilitations [REQUIREMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. It is a modest annual compliance for a significant tax difference, and we sequence it with FBR registration at setup.
As of mid-2026 there is no general Pakistani statute dictating where data must sit, so the answer comes from your customers' contracts and regulators — banks bring the State Bank's outsourcing expectations, foreign enterprises bring GDPR-style terms. We build a data map and contractual position you can show an enterprise procurement team.
Absent a written assignment, likely the freelancers — the Copyright Ordinance 1962 does not hand a contractor's work to the paying client automatically. The fix is retrospective assignment deeds from each contributor, obtained before a financing makes them leverage. Every new contractor signs assignment paper before the first commit.
Yes — liability caps and consequential-loss exclusions are standard and generally respected between businesses under the Contract Act 1872, subject to drafting quality and public-policy limits. The cap needs a carve-out architecture that matches your insurance and your data obligations, not a number copied from a US template.
Related Insights
Prepared by The First Counsel · As of 2026-07-12 · Pending professional review — statements flagged in the text are being verified
This publication is provided for general information only. It is not legal advice, and neither reading it nor corresponding with the firm about it creates a lawyer–client relationship. The position stated must be verified against current law before it is relied upon.
